fix(service-worker): Preserves explicit 'credentials: omit' in asset requests

SkyZeroZx · alxhub · commit b8bd49341ddc · 2026-05-27T10:43:19.000-07:00
Ensures that explicitly provided `credentials: 'omit'` options are preserved when creating new requests, preventing unintended credential inclusion. (cherry picked from commit 5b0e966)
diff --git a/packages/service-worker/worker/src/assets.ts b/packages/service-worker/worker/src/assets.ts
@@ -501,21 +501,27 @@ export abstract class AssetGroup {
    * Create a new `Request` based on the specified URL and `RequestInit` options, preserving only
    * metadata that are known to be safe.
    *
-   * Currently, only headers and redirect policy are preserved.
+   * Currently, headers, redirect policy, and an explicit `credentials: 'omit'` are preserved.
    *
    * NOTE:
-   *   Things like credential inclusion are intentionally omitted to avoid issues with opaque
-   *   responses.
-   *
+   *   `credentials: 'same-origin'` and `credentials: 'include'` are intentionally not preserved.
+   *   Forwarding `'include'` could leak cookies to cross-origin asset hosts, and forwarding
+   *   `'same-origin'` matches the default `fetch()` behavior so there is nothing to preserve.
    * TODO(gkalpak):
    *   Investigate preserving more metadata. See, also, discussion on preserving `mode`:
-   *   https://github.com/angular/angular/issues/41931#issuecomment-1227601347
+   *   https://github.com/angular/angular/issues/41931#issuecomment-1227601347.
    */
   private newRequestWithMetadata(url: string, options: RequestInit): Request {
-    return this.adapter.newRequest(url, {
+    const init: RequestInit = {
       headers: options.headers,
       redirect: options.redirect,
-    });
+    };
+
+    if (options.credentials === 'omit') {
+      init.credentials = 'omit';
+    }
+
+    return this.adapter.newRequest(url, init);
   }
 
   /**
diff --git a/packages/service-worker/worker/test/happy_spec.ts b/packages/service-worker/worker/test/happy_spec.ts
@@ -1655,6 +1655,18 @@ import {envIsSupported} from '../testing/utils';
         expect((bazReq as any).unknownOption).toBeUndefined();
       });
 
+      it(`passes 'credentials: omit' through to the server`, async () => {
+        // Request a lazy-cached asset (so that it is fetched from the network) and provide an
+        // explicit anonymous credentials mode.
+        const reqInit = {credentials: 'omit'};
+        expect(await makeRequest(scope, '/baz.txt', undefined, reqInit)).toBe('this is baz');
+
+        // Verify that the explicit `'omit'` value was preserved (instead of being replaced by the
+        // default `'same-origin'`).
+        const [bazReq] = server.getRequestsFor('/baz.txt');
+        expect(bazReq.credentials).toBe('omit');
+      });
+
       describe('for redirect requests', () => {
         it('passes headers through to the server', async () => {
           // Request a redirected, lazy-cached asset (so that it is fetched from the network) and
@@ -1695,6 +1707,20 @@ import {envIsSupported} from '../testing/utils';
             makeRequest(scope, '/lazy/redirected.txt', undefined, {redirect: 'error'}),
           ).toBeRejected();
         });
+
+        it(`passes 'credentials: omit' through to the server`, async () => {
+          // Request a redirected, lazy-cached asset (so that it is fetched from the network) and
+          // provide an explicit anonymous credentials mode.
+          const reqInit = {credentials: 'omit'};
+          expect(await makeRequest(scope, '/lazy/redirected.txt', undefined, reqInit)).toBe(
+            'this was a redirect too',
+          );
+
+          // Verify that the explicit `'omit'` value was preserved across the redirect
+          // reconstruction (instead of being replaced by the default `'same-origin'`).
+          const [redirectReq] = server.getRequestsFor('/lazy/redirect-target.txt');
+          expect(redirectReq.credentials).toBe('omit');
+        });
       });
     });
 
